...

Migrating to REFEDS R&S Phase II

Outline of Phase II

Migration Process for Existing R&S IdPs

To migrate to REFEDS R&S, an IdP that supports R&S completes the following sequence of steps:

1. Review the authoritative REFEDS Research & Scholarship Entity Category specification

2. Change your IdP's attribute release policy from this:

   Code Block
   title The configuration of an IdP that HAS NOT migrated to REFEDS R&S
   <afp:AttributeFilterPolicy id="releaseFullBundleToRandS"> <afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://id.incommon.org/category/research-and-scholarship"/> <!-- attribute rules here --> </afp:AttributeFilterPolicy>

   to this:
   

   Code Block
   title The configuration of an IdP that HAS migrated to REFEDS R&S
   <afp:AttributeFilterPolicy id="releaseFullBundleToRandS"> <afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://refeds.org/category/research-and-scholarship"/> <!-- attribute rules here --> </afp:AttributeFilterPolicy>

   The latter configuration recognizes the REFEDS R&S entity attribute value instead of the legacy InCommon R&S entity attribute value.

3. Declare your ability to support REFEDS R&S by submitting a short form

That's all an existing R&S IdP has to do to migrate to REFEDS R&S!

When an R&S IdP migrates to REFEDS R&S (as above), the , a multivalued entity attribute in IdP metadata is changed from this:

<mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
  <!-- the InCommon entity attribute value for R&amp;S IdPs -->
  <saml:Attribute
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
      Name="http://macedir.org/entity-category-support">
    <saml:AttributeValue>
      http://id.incommon.org/category/research-and-scholarship
    </saml:AttributeValue>
  </saml:Attribute>
</mdattr:EntityAttributes>

to this:

<mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
  <!-- multivalued entity attribute for R&amp;S IdPs -->
  <saml:Attribute
      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
      Name="http://macedir.org/entity-category-support">
    <saml:AttributeValue>
      http://id.incommon.org/category/research-and-scholarship
    </saml:AttributeValue>
    <saml:AttributeValue>
      http://refeds.org/category/research-and-scholarship
    </saml:AttributeValue>
  </saml:Attribute>
</mdattr:EntityAttributes>

Note, however, that is inserted into IdP metadata. Whether or not an IdP completes the migration, only the REFEDS R&S entity attribute value is exported to eduGAIN!:

See the R&S Entity Metadata wiki page for details about entity attributes in metadata.

Decision Point for TAC

Two concrete options are outlined for convenience but of course a range of options is possible.

...